Guard: watch logs, ban misbehaving addresses in Housecarl

Files and the journal, patterns with one <IP>, bounties within a window,
bans in a Housecarl ban list with repeat offenders' bans growing; presets
for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot,
nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban;
a Debian package with a sandboxed unit; an end-to-end test with Housecarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to Guard are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
+[Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+### Added
+
+- First version. Guard watches log files (followed through rotation and
+  truncation) and the systemd journal (by unit and syslog identifier),
+  matches lines with patterns holding one `<IP>`, counts each address's
+  bounty within a window, and bans an address that reaches a watch's
+  hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the
+  watch's protocol and ports, for a time that grows for repeat
+  offenders. IPv6 addresses are counted and banned by the ban list's
+  prefix (/64). Never banned: `never_ban` (addresses, prefixes, host
+  names), loopback, link-local, multicast; Housecarl adds its own. Bans
+  wait while Housecarl can't be reached, across restarts.
+- Presets: `sshd`, `jarl`, `housecarl`, `steward`, `bind-xfr`,
+  `postfix-sasl`, `dovecot`, `nginx-auth`, `housecarl-drops`
+  (Housecarl's log of dropped packets, TCP only by default).
+- Commands: `guard run`, `check`, `config [--example]`, `presets`,
+  `test` (a watch's patterns over a log), `status` (through a local
+  socket), `bans`, `ban`, `unban`, `version`.
+- A Debian package with a sandboxed systemd unit, as the `guard` user in
+  the `adm` and `systemd-journal` groups.